Cyber Resilience

CVE-2025-39813

Race Condition in Linux Kernel 2.6.28 – 5.4.298

Published
16 September 2025
Modified
12 May 2026
Patch / advisory
CVSS Score v3.1 4.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0011 2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-39813 is a medium-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 4.7 (Medium).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-39 (Process Isolation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs…

more

because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-38078Same product: Debian Debian Linux
CVE-2024-26984Same product: Debian Debian Linux
CVE-2025-38687Same product: Debian Debian Linux
CVE-2024-35898Same product: Debian Debian Linux
CVE-2024-35848Same product: Debian Debian Linux
CVE-2024-26897Same product: Debian Debian Linux
CVE-2025-38561Same product: Debian Debian Linux
CVE-2024-35809Same product: Debian Debian Linux
CVE-2024-26960Same product: Debian Debian Linux
CVE-2024-27030Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
6.17 · 2.6.28 — 5.4.298 · 5.5 — 5.10.242 · 5.11 — 5.15.191
debian
debian linux
11.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V10.4.2
  • V10.4.5
  • V15.1.3
  • V15.4.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces access checks on shared kernel tracing structures (ring buffer/seq) to block unsynchronized concurrent use between ftrace_dump and trace_pipe readers.

prevent

Provides process/thread isolation boundaries that reduce the likelihood of races on kernel-internal shared state such as the trace iterator.

prevent

Requires robust handling of unexpected internal states (NULL return after reset) so the WARN_ON path that the race triggers is never reached.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect race conditions, but does not prevent them at design or coding time.

prevents

Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.

prevents

Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.

prevents

Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.

prevents

Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.

none

Change management reduces introduction of concurrency bugs during updates, yet does not address the weakness itself.

References